Methods for detecting and classifying signals transmitted over a radio frequency spectrum

ABSTRACT

A method for classifying a signal is disclosed. The method can be used by a station or stations within a network to classify the signal as non-cooperative (NC) or a target signal. The method performs classification over channels within a frequency spectrum. The percentage of power above a first threshold is computed for a channel. Based on the percentage, a signal is classified as a narrowband signal. If the percentage indicates the absence of a narrowband signal, then a lower second threshold is applied to confirm the absence according to the percentage of power above the second threshold. The signal is classified as a narrowband signal or pre-classified as a wideband signal based on the percentage. Pre-classified wideband signals are classified as a wideband NC signal or target signal using spectrum masks.

This application is a divisional of application Ser. No. 11/839,503filed Aug. 15, 2007, entitled “Methods for Detecting and ClassifyingSignals Transmitted Over a Radio Frequency Spectrum”, the contents ofwhich are hereby incorporated herein by reference in their entirety.

GOVERNMENT INTERESTS

The work leading to this invention was funded in part by the DefenseAdvanced Research Projects Agency (DARPA), grant number:FA8750-05-C-0150. The U.S. Government may have certain rights in thisinvention.

TECHNICAL FIELD

The following is related to detecting and classifying signals onchannels within a spectrum of interest, and more particularly toperforming signal detection and classification based on detector scans.

BACKGROUND

Wireless networks enable connectivity between different stations, nodesand the like. The different stations may reside in different locationsand operate on designated frequency channels. The number of channelallocations available depends on the total amount of designated spectrumand spectrum availability.

Some networks are allowed to operate in any channel within thedesignated frequency spectrums as long as the channel or channels arenot being used. Channels occupied by the transmission sources alreadyoperating within the designated spectrum range are to be detected andclassified by transmitted signal type. Further, identification of targetsignals is required for network setup. The signals other than targetsignals are referred to as non-cooperative (NC) signals.

Errors in the detection and classification processes result in potentialinterference with other transmission sources and inefficiencies intarget network operations. If a channel is classified incorrectly ashaving “No signal”, then the station operating in this channel willcause interference with other NC networks or NC transmitters that arenot part of the station's network. If the target signal in a channel ismisclassified as any other type, the network setup or operations will becompromised.

BRIEF DESCRIPTION OF THE DRAWINGS

The accompanying drawings are included to provide further understandingof the invention and constitute a part of the specification. The figureslisted below illustrate embodiments of the invention, and, together withthe following description, serve to explain the subject matter of theinvention.

FIG. 1 illustrates radios and stations according to the disclosedembodiments.

FIG. 2 illustrates a set of channels within a spectrum of interestaccording to the disclosed embodiments.

FIG. 3 illustrates a flowchart for identifying and classifying a signalaccording to the disclosed embodiments.

FIG. 3A continues the flowchart of FIG. 3.

FIG. 3B continues the flowchart of FIG. 3.

FIG. 3C continues the flowchart of FIG. 3.

FIG. 4 depicts a graph showing power and frequency characteristicsaccording to the disclosed embodiments.

DETAILED DESCRIPTION Overview

The systems and methods described herein can detect and classify signalswith a detector. Using classification algorithms, the detectordetermines whether the signal is present and, if a signal is present,the type of signal. Thus, the detector can be configured to monitor thespectrum over a frequency range of interest for signals of interest,which are referred to as target signals. An example target signal is anext generation (XG) signal. A target signal, however, is not limited toXG signal and can be any signal of interest of any type.

The methods for detection and classification described herein can beimplemented using a cognitive radio. A cognitive radio capable ofperforming the disclosed methods is described in co-pending patentapplication titled “SYSTEMS AND METHODS FOR A COGNITIVE RADIO HAVINGADAPTABLE CHARACTERISTICS,” U.S. patent application Ser. No. 11/839,496filed on Aug. 15, 2007, the contents of which are hereby incorporated byreference in their entirety.

A station actively participating in a network strives to detectnon-cooperative signals as early as possible to avoid causinginterference with other transmission sources. Further, the networkshould correctly identify a detected signal as a target signal or anon-cooperative signal.

The methods and algorithms implemented by the detector perform signaldetection and classification based on a number of most recent detectorspectrum scans utilizing a multi-stage classification procedure usingspectrum masks and a multi-level threshold structure. The spectrum ofinterest is sub-divided into regions of size equal to the minimum targetchannel size. These regions also are referred to as “channels.” Thechannels may be contiguous.

The detection and classification of potential signals are performed instages on a channel-by-channel basis. A first stage detects narrow-bandsignals, defined as signal bandwidths less than the minimum targetsignal bandwidth, based on the spectrum power profile computed using thelast detector scan. A second stage executes when no narrowband signal isdetected using the first stage disclosed above. During the second stage,embodiments of the present invention apply max-hold power spectrumscomputed using a number of spectrum power profiles determined using thelast multiple number of detector scans. The max-hold spectrum powerrefers to the resulting envelope of the multiple overlaying spectrumpower profiles. The second stage classifies signals in channels thathave not been filtered out as narrowband channels during the firstclassification stage as target, wideband NC [non-cooperative] or “no”signals.

In some embodiments, a method for classifying a signal within a channelcan be performed. The method includes classifying a signal as anarrowband signal by applying a first threshold and a second threshold.The second threshold is lower than the first threshold. The method alsoincludes, if the signal is not a narrowband signal, classifying thesignal as a target signal by applying a mask to the channel to determinea degree of correlation between the mask and the target signal. Themethod also includes, if the signal is not a narrowband or targetsignal, classifying the signal as a wideband signal.

In some embodiments, a method for detecting a narrowband signal within achannel is performed. The method includes applying a first threshold toa signal in a channel. The method also includes determining whether thesignal is a narrowband signal according to the threshold. The methodalso includes applying a second threshold to the signal. The method alsoincludes confirming the signal is the narrowband signal according to thesecond threshold.

In some embodiments, a method for detecting a wideband signal within achannel is performed. The method includes applying a first threshold toa signal within the channel. The method also includes determining thesignal is a wideband signal according to the first threshold. The methodalso includes applying a second threshold to the signal if the firstthreshold indicates that signal is not a wideband signal. The methodalso includes confirming the signal is not the wideband signal accordingto the second threshold.

In some embodiments, a method for detecting a target signal isperformed. The method includes determining whether a signal is anarrowband signal. The method also includes determining whether thesignal is a wideband signal if the signal is not the narrowband signal.The method also includes applying a channel mask to the signal if thesignal is not the narrowband signal or the wideband signal. The methodalso includes determining whether the signal is a target signal. Thetarget signal correlates to the channel mask.

Detection and Classification

In some embodiments, detection and classification can be performed bydetermining the presence of a narrowband signal in at least one channel.Spectrum can be examined on a channel by channel basis. In suchembodiments, the presence of the signal can be determined by hardlimiting spectrum power profile components within the channel using afirst narrowband amplitude threshold. Subsequently, the narrowbandsignal presence within a channel is identified by an exclusion based onthe comparison of the hard-limited spectrum power profile against thenarrowest target signal spectrum mask using a minimum bandwidththreshold as test criteria.

The absence of a narrowband signal in a channel is confirmed byrepeating the hard limiting step above using a second narrowbandamplitude threshold. The second narrowband amplitude threshold is lowerthan the first narrowband amplitude threshold. The second hard-limitedspectrum power profile is then compared to a second threshold using aminimum bandwidth threshold as test criteria to confirm the absence of anarrowband signal. The narrowband signal presence determinationclassifies narrowband—conformant signals as “narrowband signals.”

The detection and classification steps also include pre-classifyingnarrowband non-conformant signals, if any, as wideband signal candidatesand proceeding with further classification steps disclosed below. Afurther classification step includes computing an envelope of spectrumpower profile across a frequency range of interest using N single-scanspectrums power profiles by using data collected during last N detectorscans.

Steps for determining the presence of a wideband signal includes hardlimiting max-hold spectrum power profile components using the firstwideband amplitude threshold. The steps also include identifyingpotential wideband candidates within a channel by exclusion based on thecomparison of the hard limited spectrum components computed aboveagainst the narrowest target signal spectrum mask using a minimumbandwidth threshold as test criteria.

Additional steps for determining the presence of the wideband signal caninclude confirming non-compliant wideband candidates determinedpreviously by repeating the hard limiting step disclosed above using asecond wideband amplitude threshold that is lower than the firstthreshold disclosed above and comparing the second hard-limited spectrumpower profile to the narrowest target signal spectrum mask using aminimum bandwidth threshold. The steps also include classifying theresulting wideband non-conformant candidates into a “no-signal”category.

Other steps for classifying a signal includes classifying widebandconformant signals as target signal candidates and proceeding withfurther classification steps as disclosed below. The following steps forclassification include identifying a target signal spanning a singlechannel using the correlation of the hard-limited max-hold powerspectrum computed using a first wideband amplitude threshold and thenarrowest target signal channel mask comprising a target signal spectrumpower mask and a guard band mask.

The steps for wideband conformant classification also includes, for atleast one target signal type spanning multiple channels, identifyingtarget signals of a type using multi-channel segments of the max-holdpower spectrum computed in the steps disclosed above and the targetsignal channel masks of the target signal type comprising target signalspectrum profiles and guard bands, and classifying target signalconformant signals as “target signals” of the type given by the matchingchannel masks. The steps also include classifying target signalnon-conformant signals as “wideband non-cooperative signals.”

FIG. 1 depicts radios and stations used in networks according to thedisclosed embodiments. FIG. 1 shows two networks 100 and 102.Preferably, network 100 may be a network that operates within afrequency spectrum that is available and not being used by othernetworks, transmitters, stations and the like. For example, network 102may be referred to as a non-cooperative (NC) network that may or may notoperate within the frequency spectrum available to network 100.

Both networks 100 and 102 include radios or stations that communicatewith each other. For example, station 104 transmits and receives signalsfrom stations 106, 108 and 110. Stations 104-110 may operate on the samechannel so that each station is tuned to the same frequency. Stations104-110 comprise network 100. Station 104 also includes detector 180that detects and classifies signals 120

Network 102 includes stations 112, 114 and 116. Stations 112-116transmit and receive signals 122 from each other. Due to the proximityof the networks, some signals from network 102 reach stations withinnetwork 100. For example, station 104 receives NC signals 124 and 126.Further, NC signals 124 and 126 are not necessarily identical. Forexample, NC signal 124 is a narrowband NC signal and signal 126 is awideband NC signal. Detector 180 detects and classifies NC signals 124and 126

FIG. 2 depicts a set of channels within a spectrum of interest accordingto the disclosed embodiments. Spectrum 200 includes a range within afrequency band that is of interest and possibly available to network100. Spectrum 200 includes channels 202, 204, 206 and 208, and also mayinclude additional channels that are not shown. Channels in spectrum 200may be contiguous and/or overlapping. Channel 202 encompasses afrequency range within spectrum 200. The other channels shown by FIG. 2are similar to channel 202. The signals detected within spectrum 200 mayhave smaller or larger bandwidth than bandwidth of channels 202-208.

The size of channel 202 is selected to correspond with the size of thesmallest target signal. For example, if the bandwidth for the smallesttarget signal is about 1.75 MHz, then the bandwidth for channel 202 isabout 2 MHz. A larger target signal is about 3.5, MHz, so that two 2 MHzchannels are occupied by the target signal. Another target signal couldbe about 7 MHz and occupy four 2 MHz channels.

A detector according to the present invention scans spectrum 200 andmeasures the energy within a sequence of bins to determine the presenceof a potential signal. The size of the bins depends on a desireddetector resolution. Energy within a bin, such as bin 212, correspondsto the strength of a signal present within the frequency range of thebandwidth of the bin.

As disclosed above, the potential target signals 120 are classified intodifferent types of signals, such as target signals, narrowband NCsignals or wideband NC signals, or no signal. A potential signal isclassified as “no signal” if the measured signal energy does not meetcriteria for classification to the types.

The spectrum of the narrowest target signal 120 is contained withinchannel 202. The width of the signal's power spectrum, centered in themiddle of the channel, is narrower than the channel width. The spectrumregions within the channel 202 to the left and to the right of targetsignal's spectrum are called guard bands.

Other types of signals include NC signals from a non-cooperative source,such as a station operating in NC network 104. NC signals can havevarying bandwidths and operate within different frequency ranges, evenwithin spectrum 200. Referring to FIG. 2, narrowband NC signal 124within channel 204 indicates a narrowband NC signal having a bandwidthsmaller than the minimum bandwidth attic target signal or havingspectrum mask different from target signal. “Narrowband” relates to thebandwidth of the signal to detect relative to the bandwidth of thesmallest target signal, and not to the NC signal itself. Multiplenarrowband NC signals 124 may occupy channel 204.

Wideband NC signal 126 represents a wideband NC signal that occupies aportion of spectrum 200 occupying, or spanning, more than one channel.For example, signal 126 occupies spectrum over channels 206 and 208.According to the disclosed embodiments, if a signal is not determined tobe a target signal, a narrowband NC signal or “no signal,” then thesignal is classified as a wideband NC signal. Referring back to FIG. 1,detector 180 implements an algorithm to detect and classify signalsbased on their power spectrum profile.

FIGS. 3 and 3A-C depict flowcharts for detecting and classifying asignal according to the disclosed embodiments. The steps disclosed bythe flowchart may be implemented as steps within a program executable ona processor and stored on a computer-readable medium. The steps may beexecuted by detector 180 and/or station 104, disclosed above. Further,the steps disclosed below are general in nature such that variations maybe made that are within the scope of the present invention.

Referring to FIG. 3, step 302 executes by providing a channel map forthe spectrum of interest, such as spectrum 200. Step 304 executes bygenerating the last detector scan and an array of scans of the spectrum.The array of scans may be any number of scans performed by a detectorover a period of time.

Step 308 executes by channelizing the spectrum scan. In other words, thescan of the spectrum of interest is broken into channels having apredetermined bandwidth and frequency boundaries. For example, if achannel has a 2 MHz bandwidth, then the spectrum may be channelized into2 MHz channels centered around frequency fc=(2*n+1) MHz (where n ispositive integer) for analysis. Channels can be overlapping in frequencywith multiple successive channels. Step 309 executes by looping to thenext channel within spectrum 200.

Steps 310 to 338 disclose the analysis and processes executed for eachchannel. After each channel, the flowchart of FIG. 3 returns to step309, except for the last channel. Thus, step 310 executes by determininga narrowband (NB) signal presence within the channel. This step isdisclosed in greater detail by FIG. 3A. Step 312 executes by determiningwhether a narrowband signal is detected within the channel. If anarrowband signal is present, then it should occupy a fraction of thechannel. If yes, then step 314 executes by declaring the signal detectedwithin a channel as narrowband non-cooperative signal.

If step 312 is no, then step 316 executes by declaring the channel to bea candidate to have a wideband (WB) signal. Step 318 executes bycomputing the max hold power spectrum across the spectrum. Thecomputation uses data of signal power levels collected during a numberof detectors scans. Thus, the max hold is a representation of spectrumas measured. Because multipath and fading channel properties may changefrom scan to scan, the overlaying of several scans allows the resultantrepresentation to have a more precise picture of signals and powerlevels within a channel.

Step 320 executes by determining wideband signal presence in thechannel. This step is disclosed in greater detail by FIG. 3B. Step 322executes by determining whether a wideband signal is present within thechannel. If no, then step 324 executes by declaring no signal is withinthe channel.

If yes, then step 330 executes by determining target signal presencewithin the channel. Before declaring a wideband signal presence, thedisclosed embodiments confirm the detected signal is not a targetsignal. This step is disclosed in greater detail by FIG. 3C. Step 332executes by determining whether a target signal is present within thechannel.

If yes, then step 334 executes by declaring the detection of a targetsignal in the channel. Various types of target signals may be present,so the disclosed embodiments also determining the type of target signal.If no, then step 336 executes by declaring the signal detected in thechannel as wideband non-cooperative signal. Step 338 executes bydetermining whether another channel is left to analyze in spectrum 200.If not, then step 340 executes by ending the flowchart. If yes, then theflowchart goes back to step 309 and loops to the next channel.

FIG. 3A depicts a flowchart for executing the narrowband detection ofFIG. 3. FIG. 3A discloses steps 310 and 312 of FIG. 3 in greater detail.As disclosed above, a narrowband signal is a non-cooperative signal thatoccupies a fraction of a channel. Examples of NC narrowband signals arenow described.

A graph can depict signal spectrum power over a frequency range, orspectrum. The vertical axis of the graph shows the s power (P) while thehorizontal axis shows the frequency (f). Other channels also may bewithin the spectrum.

Two NC signals occupy the channel and are centered on frequencies f3 andf4, respectively. A threshold T1 designates the power level needed fordetection of signal within channel 202. Power levels above threshold T1indicate the presence of a signal. The bandwidth of NB signals is lessthan the smallest bandwidth of target signal as spectrum mask M1.

Returning to FIG. 3A, step 3100 executes by indicating step 310 has beenaccessed. Thus, a narrowband presence determination is to be performed.Step 3102 executes by applying threshold T1 to the channel. Step 3102hard limits any signals within the channel with threshold T1. Step 3104executes by applying mask M1 to the hard-limited channel spectrum.

Step 3106 executes by determining whether any narrowband NC signals weredetected in the channel. A narrowband NC signal is detected based ondegree of correlation of the channel power spectrum hard-limited usingthreshold T1 and the target signal mask M1. If yes, then step 3108executes to confirming the presence of the narrowband signal. Theconfirmation prevents a potential misclassification if parts of awideband or target signal are above threshold T1. The parts of thesignal above threshold T1 may appear as narrowband signals. Confirmationis performed by applying another threshold and same mask so thatmisclassifications are prevented.

Similar to step 3102, step 3110 executes by applying a second thresholdT2 to confirm the presence of a narrowband signal. The second thresholdT2, however, is lower than the first threshold T1 in order to detectweaker target signal. The confirmation prevents the potentialmisclassification when parts of the target signal are above the firstthreshold. Step 3112 executes by applying mask M1 as before to the powerspectrum hard-limited using threshold T2.

Another graph can be described for a signal found using threshold T2,having a vertical axis for power (P) and a horizontal axis for frequency(f). The frequency axis includes channel 202 between frequencies f1 andf2. A target signal occurs in channel 202. The target signal includespeaks having power levels above threshold T1. Hard-limiting the signalusing threshold T1 makes the signal appear as three narrowband signalsbecause a small fraction of its spectrum components exceeds thethreshold T1.

Thus, the threshold is lowered to threshold T2. Threshold T2 is placedat a power level lower than threshold T1. For example, threshold T2 maybe a percentage reduction in power from threshold T1. Alternatively,threshold T2 is set at a fixed value lower than threshold T1. Applyingthreshold T2, the percentage of signal power above the threshold showsthat the target signal is not a narrowband signal. Thus, the targetsignal will not be misclassified as a narrowband signal.

Referring back to FIG. 3A, step 3114 executes by determining whether thesignal or signals in the channel pass the criteria for a narrowbandsignal in view of threshold T2. As before, signal is classified asnarrowband signal based on degree of correlation between thehard-limited signal spectrum and mask M1. If signal is not classified asnarrowband, then step 3116 is executed by returning to the flowchart ofFIG. 3, and going to step 316. The signal detected in the channel isdeclared a wideband candidate signal, and undergoes additional analysisprior to classification. If yes, then step 3118 is executed by returningthe flowchart of FIG. 3 and going to step 314. The signal or signalsdetected in the channel are declared narrowband NC signals as a resultof “passing” mask correlation tests using thresholds T1 and T2.

Thus, the flowchart of FIG. 3A serves to disclose a method or processfor excluding narrowband NC signals from further classificationanalysis. If the detected signal is not a narrowband signal, thenadditional steps are taken before classification of the signal.

FIG. 3B depicts a flowchart for executing the wideband analysis of FIG.3. FIG. 3B discloses steps 320 and 322 in greater detail. Step 3200executes by indicating step 320 has been accessed. Thus, a widebandsignal presence determination is to be performed. Step 3202 executes byapplying threshold T3 to the max hold power spectrum computed in step318 of FIG. 3. Unlike the narrowband analysis, the applicable thresholddepends upon the max-hold overlays instead of a single detector scan. Asnoted above, the max hold is a representation of the spectrum asmeasured.

Step 3204 executes by applying a channel mask to the max hold powerspectrum. A high degree of correlation between the measured channelspectrum power and the channel mask indicates a high probability of thedesired signal. In other words, the degree of matching the measuredspectrum to the channel mask is used to determine if a target signal ispresent.

Referring to FIG. 4, graph 400 shows the measured spectrum power over afrequency spectrum. Power (P) is shown on the vertical axis andfrequency (0 is shown on the horizontal axis. Signal 402 occurs withinchannel 202. Signal 402 has been determined to not be a narrowbandsignal by the disclosed process, and may be classified as a targetsignal, wideband signal or noise (“no signal”). In classifying signal402, the channel 202 spectrum power is hard-limited using threshold T3.

The hard-limited spectrum is correlated with a channel mask for furthersignal classification. The threshold value impacts the shape of thehard-limited channel spectrum profile and thus the correlation output.FIG. 4 shows three examples of a signal within channel 202 to illustratehow threshold value affects the classification.

Referring to FIG. 4, thresholds T3 and T4 are applied much likethresholds T1 and T2 disclosed above. Threshold T4 is set lower thanthreshold T3 to detect weaker signals.

Example 1 shows a target signal and its relation to thresholds T3 andT4. Example 2 shows a signal that would be misclassified as noise whenthreshold T3 is applied. When spectrum in Example 2 is hard-limitedusing threshold T3 it will poorly correlate with the channel maskresulting in “noise” classification. Using the lower threshold value T4would yield the proper representation of the channel spectrum by itshard-limited replica resulting in high correlation of channel spectrumwith channel mask. Misclassification, therefore, is avoided whenthreshold T4 is applied. Therefore, in example 2, threshold T3 wouldimproperly classify target signal 404 as noise, while threshold T4 wouldprevent misclassification.

Example 3 of FIG. 4 shows a different scenario where a target signal 406is within channel 202. This example illustrates when signal is emittedby a nearby transmitter yielding significant energy in the adjacentspectrum. In this example, using threshold T3 would result in anaccurate representation of channel spectrum, while using threshold T4will obscure the guard bands leading to misclassification of targetsignal as a wideband signal 406 takes up most of the channel.

Examples 2 and 3 illustrate why two thresholds are necessary forwideband signal detection.

Step 3206 executes by determining whether the signal is classified as awideband signal according to the results generated from applyingthreshold T3 and the appropriate mask. If yes, then step 3212 isexecuted. If not, then step 3208 executes by applying a lower thresholdT4 to ensure that a wideband signal in channel 202 is not misclassifiedas “no signal.”

Step 3209 executes by applying a channel mask, as disclosed above, againto determine the correlation between the appropriate mask and thedetected power in the channel. Step 3210 executes by determining whetherthe pre-classified wideband signals classified as a wideband signalaccording to the results generated from applying threshold T4 and theappropriate mask.

Step 3210 is similar to step 3206 except the percentage of signal powerin the spectrum, or channel 202, above threshold T4 should be differentif a signal is present. If no, then step 3214 executes by classifyingthe power within the channel as noise or “no signal,” and goes to step324 in FIG. 3. If step 3210 is yes, then step 3212 executes bydetermining the presence of a wideband or target signal in the channeland goes to step 330 in FIG. 3.

FIG. 3C depicts a flowchart for executing the target signal analysis ofFIG. 3. FIG. 3C discloses steps 330 and 332 in greater detail. At thispoint, the power detected in the channel, such as channel 202 in FIG. 4,may be either a target signal or NC signal. The process will applyvarious masks to the signal to determine if it is a target signal. Ifnot, then the signal is classified as NC signal. Step 3300 executes byindicating step 330 has been accessed. Thus, a target signal presencedetermination is to be performed.

Step 3302 executes by selecting a target signal channel mask from aplurality of target signal channel masks. The target signal channelmasks correspond to the different types of target signals that might befound operating in the channel. For example, referring to FIG. 4, maskM2 is a target signal channel mask for a 1.75 MHz target signal. Step3304 executes by applying the target signal channel mask to the signaldetermined in step 322 to be within the channel.

Step 3306 executes by determining the degree of correlation between thesignal in the channel and the target signal channel mask. The “area” ofthe mask is compared to the signal determined in step 322 to be withinthe channel, as well as mean and variance of the signal and mask.Peak-to-mean ratio, proximity to noise floor as well as other parametersplaya part in the decision process, Those parts of the mask thatcorrespond to signal power in the channel signify the degree of acorrelation. A high degree of correlation indicates a strong probabilitythat the signal corresponding to the target signal channel mask ispresent.

Step 3314 executes by applying some or all of the available masks to thesignal determined in step 322 to be within the channel and returning tostep 3304. Step 3308 executes by determining whether the applied maskmatches the signal to a degree that indicates how the signal should beclassified. In other words, step 3308 determines whether the degree ofcorrelation between the applied mask and signal power is great enough toclassify the signal as the type of signal associated with the mask. Ifthe degree of correlation indicates a match, then step 3310 executes byclassifying the signal as the signal type exemplified by the appliedmask and going to step 334 in the flowchart of FIG. 3. If the degree ofcorrelation does not indicate a match, then the signal is classified asa wideband NC signal and, at step 3316, processing continues to step 336in FIG. 3. Thus, at the end of the flowcharts, a detected potentialsignal is classified as a narrowband or wideband NC signal, a “nosignal,” or a target signal of a certain type.

Systems and methods for detecting and classifying denial of service(DoS) attacker in a dynamic spectrum access radio are described below.The systems and methods described below can be used for detection,identification and classification of the denial of service (DoS)attacker who seeks to introduce interference into dynamic spectrumaccess radio communications. Using classification algorithms, the methoddetermines whether the DoS attacker is present and, if an attacker ispresent, the type of attacker.

Thus, the method monitors (in some embodiments, continuously) theinterference level over a frequency range of interest for targetsignals. The methods and algorithms implemented by the method performDoS attacker detection and classification based on a number of recentdetector spectrum scans, as well as collected and stored spectrumhistory data. Parameters used in the detection process can include atarget radio's statistics relating to signal-to-noise ratio (SNR),receiver signal power level, bit error rate (HER) and others.

A method for classifying a DoS attacker is described below. The methodincludes using a collected spectrum statistics database to identify theDoS attacker. The detection and classification of potential DoSattackers can be performed in stages. A first stage monitors (in someembodiments, continuously) a target radio's statistical data for apotential presence of DoS attacker. A potential for presence of the DoSattacker exists if target radio's bit error rate (BER) and othercommunication quality parameters are greater than those under normalmode of operation, even though signal-to-noise ratio (SNR) and powerlevel received from other target radios are sufficient for normaloperation.

A second stage executes when potential DoS attacker is detected usingthe first stage disclosed above. During the second stage, in someembodiments, the previously described statistical database is used toconfirm the presence of the DoS attacker as well as to classify the DoSattacker.

The DoS attacker can be classified into three categories—active,re-active and static. For the purposes of classification it is assumedthat an active DoS attacker introduces large amounts of interferencerandomly over large parts of spectrum and executes a DoS attack byvirtue of introducing interference over as much continuously varyingparts of spectrum as possible. For the purposes of classification it isassumed that a re-active DoS attacker intelligently introducesinterference only in parts of spectrum occupied by target signals andexecutes DoS attack by virtue of identifying and “following” its targetsignal. For the purposes of classification it is assumed that a staticDoS attacker introduces interference only in pre-defined static parts ofspectrum.

In order to assist in detection and identification of a potential activeor static DoS attacker, the target radio continuously or periodicallymaintains a database of spectrum history and statistics. The method canbe configured to maintain and stores such spectrum statistics as signaloccupancy information and detected power level, as well as otherstatistical data, on a per channel basis.

In order to confirm and classify an active DoS attacker, the secondstage analyzes the spectrum statistics collected in the previouslydescribed spectrum database. In order for a DoS attacker to be confirmedand classified as active DoS attacker, large amounts of interferencemust be present over large varying parts of spectrum.

In order to confirm and classify a static DoS attacker, the second stageanalyzes the spectrum statistics collected in the previously mentionedspectrum database. In order for a DoS attacker to be confirmed andclassified as static DoS attacker, large amounts of interference must bepresent over static parts of spectrum. The algorithm looks for a degreeof correlation among the spectrum data samples inside the spectrumdatabase.

In order to assist in detection and identification of a potentialre-active DoS attacker, the target radio maintains a database of howoften it has been forced to change frequency of operation andre-establish connection with other target radios due to poor networkoperation and connectivity. At the same time the radio continues tomonitor the frequencies from which it has been forced to move in orderto validate whether the introduced interference is actually a usefulradio system or an attempted DoS attack.

In order to confirm and classify a re-active DoS attacker, the secondstage analyzes the spectrum statistics collected in the above mentionedspectrum database. As described in the definition of a re-active DoSattacker above, in order for a DoS attacker to be confirmed andclassified as re-active DoS attacker, a number of connectionreestablishment attempts must be present. This signals that a DoSattacker is following the target signal and attempts to introduceinterference.

Many specific details of certain embodiments of the invention are setforth in the description and in FIGS. 1-4 to provide a thoroughunderstanding of these embodiments. A person skilled in the art,however, will understand that the invention may be practiced withoutseveral of these details or additional details can be added to theinvention. Well-known structures and functions have not been shown ordescribed in detail to avoid unnecessarily obscuring the description ofthe embodiments of the invention. As used herein, one or more components“coupled” to each other can be coupled directly (i.e., no othercomponents are between the coupled components) or indirectly (i.e., oneor more other components can be placed between the coupled components).

Unless the context clearly requires otherwise, throughout thedescription and the claims, the words “comprise,” “comprising,” and thelike are to be construed in an inclusive sense, as opposed to anexclusive or exhaustive sense; that is to say, in the sense of“including, but not limited to.” Additionally, the words “herein,”“above,” “below,” and words of similar import, when used in thisapplication, shall refer to this application as a whole and not to anyparticular portions of this application. Where the context permits,words in the above Detailed Description using the singular or pluralnumber may also include the plural or singular number respectively. Theword “or,” in reference to a list of two or more items, covers all ofthe following interpretations of the word: any of the items in the list,all of the items in the list, and any combination of the items in thelist.

The above detailed description of embodiments of the invention is notintended to be exhaustive or to limit the invention to the precise formdisclosed above. While specific embodiments of, and examples for, theinvention are described above for illustrative purposes, variousequivalent modifications are possible within the scope of the invention,as those skilled in the relevant art will recognize. For example, whileprocesses or blocks are presented in a given order, alternativeembodiments may perform routines having steps, or employ systems havingblocks, in a different order, and some processes or blocks may bedeleted, moved, added, subdivided, combined, and/or modified to providealternative or subcombinations. Each of these processes or blocks may beimplemented in a variety of different ways. Also, while processes orblocks are at times shown as being performed in series, these processesor blocks may instead be performed in parallel, or may be performed atdifferent times.

The teachings of the invention provided herein can be applied to othersystems, not necessarily the system described above. The elements andacts of the various embodiments described above can be combined oraltered to provide further embodiments.

These and other changes can be made to the invention in light of theabove Detailed Description. While the above description describescertain embodiments of the invention, and describes the best modecontemplated, no matter how detailed the above appears in text, theinvention can be practiced in many ways. Details of the system may varyconsiderably in its implementation details, while still beingencompassed by the invention disclosed herein.

The terminology used in the Detailed Description is intended to beinterpreted in its broadest reasonable manner, even though it is beingused in conjunction with a detailed description of certain specificembodiments of the invention. Certain terms may even be emphasized;however, any terminology intended to be interpreted in any restrictedmanner will be overtly and specifically defined as such in this DetailedDescription section. In general, the terms used in the following claimsshould not be construed to limit the invention to the specificembodiments disclosed in the specification, unless the above DetailedDescription section explicitly defines such terms. Accordingly, theactual scope of the invention encompasses not only the disclosedembodiments, but also all equivalent ways of practicing or implementingthe invention under the claims.

The invention claimed is:
 1. A method for detecting and classifying adenial of service (DoS) attacker, the method comprising: receiving, at aradio frequency (RF) detector, RF signals received by a target radioover a radio frequency range of interest; generating statistical databased upon the received RF signals; detecting a potential DoS attackerby identifying a change in communication quality based on thestatistical data; determining that the change in communication qualityoccurs over different parts of the radio frequency range of interestover a period of time; and classifying the potential DoS attacker as anactive DoS attacker.
 2. The method of claim 1, further comprisingclassifying the potential DoS attacker as a reactive DoS attacker if anumber of connection re-establishment attempts are present.
 3. Themethod of claim 1, further comprising periodically maintaining adatabase of spectrum history and statistics.
 4. The method of claim 1,wherein the statistics comprise an indication of how often the targetradio changes frequency of operation due to poor network operation, poorconnectivity, or both.
 5. The method of claim 1, further comprisingmonitoring frequencies previously used by the target radio to validatewhether the change in communication quality is an attempted DoS attack.6. A method for detecting and classifying a denial of service (DoS)attacker, the method comprising: receiving, at a radio frequency (RF)detector, RF signals received by a target radio over a radio frequencyrange of interest; generating statistical data based upon the receivedRF signals; detecting a potential DoS attacker by identifying a changein communication quality based on the statistical data; determining thatthe change in communication quality occurs over a static portion of theradio frequency range of interest over a period of time; and classifyingthe potential DoS attacker as a static DoS attacker.
 7. The method ofclaim 6, further comprising classifying the potential DoS attacker as areactive DoS attacker if a number of connection re-establishmentattempts are present.
 8. The method of claim 6, further comprisingperiodically maintaining a database of spectrum history and statistics.9. The method of claim 6, wherein the statistics comprise an indicationof how often the target radio changes frequency of operation due to poornetwork operation, poor connectivity, or both.
 10. The method of claim6, further comprising monitoring frequencies previously used by thetarget radio to validate whether the change in communication quality isan attempted DoS attack.
 11. A method for detecting and classifying adenial of service (DoS) attacker, the method comprising: receiving, at aradio frequency (RF) detector, RF signals received by a target radioover a radio frequency range of interest; generating statistical databased upon the received RF signals, the statistics comprising anindication of how often the target radio changes frequency of operationdue to poor network operation, poor connectivity, or both; detecting apotential DoS attacker by identifying a change in communication qualitybased on the statistical data; and classifying the potential DoSattacker based on the statistical data.
 12. The method of claim 11,further comprising classifying the potential DoS attacker as a reactiveDoS attacker if a number of connection re-establishment attempts arepresent.
 13. The method of claim 11, further comprising periodicallymaintaining a database of spectrum history and statistics.
 14. Themethod of claim 11, further comprising monitoring frequencies previouslyused by the target radio to validate whether the change in communicationquality is an attempted DoS attack.
 15. A method for detecting andclassifying a denial of service (DoS) attacker, the method comprising:receiving, at a radio frequency (RF) detector, RF signals received by atarget radio over a radio frequency range of interest; generatingstatistical data based upon the received RF signals; detecting apotential DoS attacker by identifying a change in communication qualitybased on the statistical data; monitoring frequencies previously used bythe target radio to validate whether the change in communication qualityis an attempted DoS attack; and classifying the potential DoS attacker.16. The method of claim 15, further comprising classifying the potentialDoS attacker as a reactive DoS attacker if a number of connectionre-establishment attempts are present.
 17. The method of claim 15,further comprising periodically maintaining a database of spectrumhistory and statistics.
 18. The method of claim 15, wherein thestatistics comprise an indication of how often the target radio changesfrequency of operation due to poor network operation, poor connectivity,or both.